Emergency management calls an external RAG model endpoint from SQL-related services and must avoid storing API keys in application settings. How should the endpoint be secured?

Authenticate to the external RAG model endpoint with a Managed Identity rather than a long-lived key in application settings. The platform issues short-lived tokens for the identity assigned to the calling Function, Logic App, App Service, or other service, and the endpoint’s authorization rules can accept that identity. This avoids storing API keys in application settings, copying them into Key Vault where copies may drift, or placing them in source control alongside the SQL Database Project. A shared API key in source control fails because secrets can spread through repository clones, CI logs, and backups. Anonymous public access removes caller authentication and exposes emergency-management RAG capacity to abuse. Personal developer tokens in production Logic App connections tie production access to an individual’s credential lifecycle and blur the separation between developer and municipal runtime identities. Exam caveat: Managed Identity addresses secret distribution for Azure-hosted callers, but you must still authorize the specific identity on the model endpoint; an identity without an allow rule is not enough. For non-Azure callers, prefer federated workload identities or short-lived tokens over static keys. Practical check: assign a system- or user-assigned Managed Identity to the caller, grant it invoke rights on the endpoint, remove API keys from app settings and repositories, and confirm calls succeed with identity tokens. Test with a different identity and expect denial; remove any residual keys and monitor invocation logs for unexpected principals.